Re­fer­ral arises from case taken by Aus­trian pri­vacy ac­tivist Schrems
Face­book’s trans­fer of Euro­pean users’ data to US comes un­der the spot­light

Le­gal un­cer­tainty sur­rounds the ca­pac­ity of com­pa­nies such as Face­book to trans­fer Euro­pean users’ data to the US af­ter a High Court judge asked the most se­nior EU court to con­sider 11 ques­tions on the is­sue.

The re­fer­ral stems from a case taken by Aus­trian pri­vacy ac­tivist Max Schrems.

The ques­tions raise sig­nif­i­cant is­sues of EU law with huge im­pli­ca­tions, in­clud­ing whether the High Court has cor­rectly found there is “mass in­dis­crim­i­nate pro­cess­ing” of data by US gov­ern­ment agen­cies un­der the Prism and Up­stream pro­grammes au­tho­rised there.

The ques­tions also ask whether EU law ap­plies to the pro­cess­ing of per­sonal data for na­tional se­cu­rity pur­poses re­gard­less of whether that data pro­cess­ing takes place in the EU or US or a third coun­try. Other ques­tions concern whether the Pri­vacy Shield De­ci­sion and other mea­sures in the US af­ford ad­e­quate pro­tec­tion for EU ci­ti­zens whose data is trans­ferred there.

The ECJ is also asked to de­cide the ex­tent of a data pro­tec­tion au­thor­ity’s (DAA) power to sus­pend data flows if it con­sid­ers a third coun­try is sub­ject to sur­veil­lance laws which con­flict with EU law. Af­ter Ms Jus­tice Caro­line Costello set out the ques­tions yes­ter­day in a for­mal re­quest to the ECJ for a pre­lim­i­nary rul­ing, Paul Gal­lagher SC, for Face­book, asked for time to con­sider that in the con­text of pos­si­bly seek­ing an ap­peal against the judge’s de­ci­sion to make a ref­er­ence to the CJEU .

Michael Collins SC, for the Data Pro­tec­tion Com­mis­sioner (DPC), queried whether there was any en­ti­tle­ment to ap­peal a High Court de­ci­sion to di­rect a ref­er­ence but did not ob­ject to Face­book be­ing given a short time to con­sider its ap­proach.

Data pri­vacy

The judge, not­ing she had given judg­ment last Oc­to­ber sanc­tion­ing a ref­er­ence, said she was anx­ious to make the re­fer­ral but would al­low Face­book time to April 30th.

Among the ques­tions for ref­er­ence in­clude whether, when de­cid­ing if data pri­vacy rights of an EU cit­i­zen are breached, the is­sue must be ex­am­ined against the EU Char­ter and EU law or the na­tional law of one or more EU states, or an amal­gam of the laws of all mem­ber states.

The High Court had found the ap­pro­pri­ate com­para­tor was EU law de­spite Face­book dis­put­ing that. The ECJ is also asked to de­cide, given find­ings by the Ir­ish court con­cern­ing US law, whether per­sonal data trans­ferred from the EU to the US un­der the EC de­ci­sions vi­o­lates the EU Char­ter.